Read RSS and Atom feeds, and speak about them only when asked (#258)

internal/rss parses RSS 2.0 and Atom, and polls each configured feed on its own
interval; internal/webfetch is the one door either of them uses to touch the
network. The poller writes items as notes with source "rss:<feed>" and nothing
else: the answer path reads them back when he asks "что нового в лентах?", and
nothing is announced on arrival. A feed that dispatched would be a nag, which is
why the plan's breaking-news rule was left out rather than built.

webfetch is where the limits live, as code rather than a paragraph: http(s)
only, an allowlist (the configured feeds' hosts) and a denylist, a 2 MiB body
cap, a 3-redirect cap, one request per host per second, and a refusal to connect
to any private address — checked in the dialer's Control hook so it holds for
every resolved address and every redirect hop, not just for a literal IP.

Off unless configured: no "feeds" block, no poller, no outbound request. How far
a feed was read is a config fact (rss:latest:<name>), so a restart does not
re-note yesterday's headlines.

internal/config/config.go

@@ -156,6 +156,11 @@ type Config struct {
 	// live in the reader (cmd/mavmaild), never here.
 	Email *EmailConfig `json:"email,omitempty"`
 
+	// Feeds — RSS/Atom feed reading (Vikunja #258). nil / absent ⇒ no feed is
+	// ever fetched: reading the outside world is off unless configured, like
+	// the weather and telegram. See FeedsConfig.
+	Feeds *FeedsConfig `json:"feeds,omitempty"`
+
 	// Praxis — the ecosystem attention-state service. When configured, maven
 	// calls the Praxis HTTP tools API for attention listing and item lifecycle.
 	// Maven never touches Praxis's database directly (ecosystem invariant: no
@@ -402,6 +407,53 @@ func (p *PatternProposalConfig) AnnounceProposals() bool {
 	return p != nil && p.Notify
 }
 
+// FeedsConfig — the RSS/Atom reader (Vikunja #258, docs/plans/13-rss-news-feeds.md).
+//
+// Absent ⇒ off, and off means no outbound request at all. Present with an empty
+// `sources` list is also off — a poller with nothing to poll is not wired.
+//
+// What a feed may NOT do here: speak. Items are written as notes with source
+// "rss:<name>" and read back when he asks; nothing is dispatched, nudged or
+// announced on arrival. That is the "not a nag" constraint, and it is why there
+// is no severity or channel field in this block to reach for.
+type FeedsConfig struct {
+	// Sources — the feeds to read. Empty ⇒ the reader stays down.
+	Sources []FeedSourceConfig `json:"sources,omitempty"`
+
+	// PollInterval — default per-feed cadence. 0 ⇒ rss.DefaultPollInterval (30m).
+	PollInterval Duration `json:"poll_interval,omitempty"`
+
+	// MaxItems — most items kept from one feed in one poll. 0 ⇒
+	// rss.DefaultMaxItems (5). This is the "не завали мне /dash" knob.
+	MaxItems int `json:"max_items,omitempty"`
+
+	// MaxAge — on a first poll (no saved mark), how far back to take items.
+	// 0 ⇒ rss.DefaultMaxAge (24h), so switching a feed on imports today, not
+	// the archive.
+	MaxAge Duration `json:"max_age,omitempty"`
+
+	// AllowHosts — when set, the reader may only connect to these hosts (and
+	// their subdomains). The feed URLs' own hosts are added automatically, so
+	// this is only needed to be stricter than that.
+	AllowHosts []string `json:"allow_hosts,omitempty"`
+
+	// Timeout — per-request budget. 0 ⇒ webfetch.DefaultTimeout.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// MaxBytes — response size cap. 0 ⇒ webfetch.DefaultMaxBytes (2 MiB).
+	MaxBytes int64 `json:"max_bytes,omitempty"`
+}
+
+// FeedSourceConfig — one feed.
+type FeedSourceConfig struct {
+	Name     string   `json:"name"`               // note source is "rss:<name>"
+	URL      string   `json:"url"`                // http(s) only
+	Category string   `json:"category,omitempty"` // "технологии" — what "что нового по X?" matches
+	Interval Duration `json:"interval,omitempty"` // 0 ⇒ FeedsConfig.PollInterval
+	Include  []string `json:"include,omitempty"`  // keep only items containing one of these
+	Exclude  []string `json:"exclude,omitempty"`  // drop items containing any of these
+}
+
 // MemoryEvalConfig — the background memory-evaluation loop (Vikunja #248).
 // Absent ⇒ off, like every other capability that costs something the owner did
 // not ask for. Each evaluation is a full LLM round-trip on the one resident
@@ -639,6 +691,12 @@ func (c *Config) applyDefaults() {
 		c.Email.Timeout = Duration(DefaultEmailTimeout)
 	}
 
+	// A feeds block with no sources is the same as no block: nothing to poll,
+	// nothing wired. Normalising it to nil keeps that "off" in one place.
+	if c.Feeds != nil && len(c.Feeds.Sources) == 0 {
+		c.Feeds = nil
+	}
+
 	if c.Voice != nil {
 		if c.Voice.RouterThreshold <= 0 {
 			c.Voice.RouterThreshold = DefaultRouterThreshold